Threats Tagged 'cwe-790'

An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths. The header injection rule was ineffective at blocking header injections in the request paths unless they were double-encoded, for example, GET /path\r\nHTTP/1.1\r\nHost: secret.example.com Note that it is unclear whether request paths with CRLF followed by additional headers would be blocked by reverse proxies, or how they would be processed by Plack-based servers.

CVE-2026-2328 is a high-severity vulnerability in WAGO Device Sphere that allows an unauthenticated remote attacker to perform path traversal due to improper input validation. This flaw enables access to backend components beyond their intended scope, potentially exposing sensitive information. The vulnerability does not require user interaction or privileges to exploit. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains an Improper Filtering of Special Elements vulnerability which, if exploited, can lead to unauthorized modification of certain information

HighVulnerabilitySwedenGermanyUnited Kingdom+7#cve#cve-2025-27260#cwe-790